Re: [sleuthkit-users] Recovering deleted file from fat32

[Anne W. <can...@ti...>]

On Wednesday 07 Jul 2004 17:49, Brian Carrier wrote:
>
> If the file can be recovered, then you can 'export' the file and then
> copy it back to its original location.  Use the latest autopsy and TSK
> because they have FAT file recovery.  They do not do file recovery in
> the classical sense because their primary focus is to examine a raw
> image of the disk and they have no write support in them at all.
>
Thanks for the reply, Brian.  I think my copy (with Mandrake 10) mustn't be 
the latest, then.  In the end I used fatback to recover them.  However, for 
future reference -

I could see the files in autopsy, but attempting to export them resulted in, 
for instance, bankrec.xls which appears to be a raw file and cannot be read 
by any of the spreadsheet programs I have.  Could I have sorted this?

Anne
-- 
Registered Linux User No.293302
Have you visited http://twiki.mdklinuxfaq.org yet?